0

It is my first time to have this https on my server, and with that I am wondering how will I do this.

I don't want my site to have the https entirely, just some parts of it. Say for example:

  • https://mysite.com/register
  • https://mysite.com/login
  • https://mysite.com/user (and other segments after /user)

I want to have other links than that be enforce by the browser to use http only.

What is the best approach or practice here that I need to know?

1
  • I think HTTPS would still be better, because even if the user is logged in you're still validating user data on each page refresh, unless you're not dealing with a log-in system. Dec 2, 2012 at 0:52

2 Answers 2

3

Ok, the overhead for https is not trivial, but if its really important to have SSL for some things, I suggest just making it all SSL. Otherwise the browser spits out confusing errors to neophytes about some things being secure and some not. Also, if you're not careful switching between SSL and non-SSL at the wrong moment can expose user data you might not intend.

In short, keep it uniform will keep headaches to a minimum.

I'm sure someone can weigh in on the overhead for SSL.

1
  • I agree with you. However, the boss doesn't want to have SSL on the entire site, that explains why. The reason for that "as they say" is the site is being blocked from a certain network. I don't know now what to do. Dec 2, 2012 at 0:54
0

Something like this in your .htaccess may solve your problem:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} ^/register|/login|/user$
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} !^/register|/login|/user$
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
2
  • 1
    Agreed - you could use the rewrite engine, but be careful. If it's written wrong you end up with the problems I mentioned above. Since he's gotta do partial HTTPS I guess this is a valid answer.
    – Ross
    Dec 2, 2012 at 1:12
  • You're totally right, and in addition there are problems of security popups appearing in some browsers (particularly IE8) in case some assets are not served using ssl (not a problem with same domain assets that are covered by the rewrite rules, but a problem with remote assets).
    – Ulflander
    Dec 2, 2012 at 1:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.